diff options
| author | Lucas Lefèvre <lul@odoo.com> | 2019-01-25 08:23:57 +0000 |
|---|---|---|
| committer | RomainLibert <rli@odoo.com> | 2019-01-25 10:37:27 +0000 |
| commit | 607fd6354514432c9ea0d215f3b52cf71e6e479f (patch) | |
| tree | 738ab05a14acce374011578160efdd8a77f4ef33 | |
| parent | 1e1ea00e66686d76a36fa0c19c3e4865e3161031 (diff) | |
[FIX] hr_fleet: fix access rights with employees without user
Commit 55a48e3 added support for computing car count and car reports
for employees without a linked user..
It is computed by accessing the field `address_home_id` (res.partner) to find the driver.
However, this field is private.
Therefore a user in `fleet_group_manager` has an ACL error when accessing
an employee form view which contains a stat button with the car count.
This commit compute the car count and the car report
with `address_home_id` as sudo to fix the issue.
Also fix a typo in attribute `groups` instead of `group` and fix its
value from `fleet_manager` to `fleet.fleet_group_manager`.
| -rw-r--r-- | addons/hr_fleet/controllers/main.py | 2 | ||||
| -rw-r--r-- | addons/hr_fleet/models/employee.py | 10 |
2 files changed, 6 insertions, 6 deletions
diff --git a/addons/hr_fleet/controllers/main.py b/addons/hr_fleet/controllers/main.py index 953358035b6..a943fdac284 100644 --- a/addons/hr_fleet/controllers/main.py +++ b/addons/hr_fleet/controllers/main.py @@ -19,7 +19,7 @@ class HrFleet(Controller): return request.not_found() employee = request.env['hr.employee'].search([('id', '=', employee_id)], limit=1) - partner_ids = (employee.user_id.partner_id | employee.address_home_id).ids + partner_ids = (employee.user_id.partner_id | employee.sudo().address_home_id).ids if not employee or not partner_ids: return request.not_found() diff --git a/addons/hr_fleet/models/employee.py b/addons/hr_fleet/models/employee.py index 5f1d9bfdff0..b9d37d0fcd5 100644 --- a/addons/hr_fleet/models/employee.py +++ b/addons/hr_fleet/models/employee.py @@ -7,12 +7,12 @@ from odoo import fields, models class Employee(models.Model): _inherit = 'hr.employee' - employee_cars_count = fields.Integer(compute="_compute_employee_cars_count", string="Cars", group="fleet_manager") + employee_cars_count = fields.Integer(compute="_compute_employee_cars_count", string="Cars", groups="fleet.fleet_group_manager") def action_open_employee_cars(self): self.ensure_one() cars = self.env['fleet.vehicle.assignation.log'].search([ - ('driver_id', 'in', (self.user_id.partner_id | self.address_home_id).ids)]).mapped('vehicle_id') + ('driver_id', 'in', (self.user_id.partner_id | self.sudo().address_home_id).ids)]).mapped('vehicle_id') return { "type": "ir.actions.act_window", @@ -23,12 +23,12 @@ class Employee(models.Model): } def _compute_employee_cars_count(self): - driver_ids = (self.mapped('user_id.partner_id') | self.mapped('address_home_id')).ids - fleet_data = self.env['fleet.vehicle.assignation.log'].sudo().read_group( + driver_ids = (self.mapped('user_id.partner_id') | self.sudo().mapped('address_home_id')).ids + fleet_data = self.env['fleet.vehicle.assignation.log'].read_group( domain=[('driver_id', 'in', driver_ids)], fields=['driver_id'], groupby=['driver_id']) mapped_data = dict([(m['driver_id'][0], m['driver_id_count']) for m in fleet_data]) for employee in self: - employee.employee_cars_count = mapped_data.get(employee.user_id.partner_id.id, 0) + mapped_data.get(employee.address_home_id.id, 0) + employee.employee_cars_count = mapped_data.get(employee.user_id.partner_id.id, 0) + mapped_data.get(employee.sudo().address_home_id.id, 0) def action_get_claim_report(self): self.ensure_one() |